SQL Injection Vulnerability in Dynamically Display Posts Plugin for WordPress

CVE-2025-11501

What is CVE-2025-11501?

The Dynamically Display Posts plugin for WordPress is susceptible to SQL injection attacks through the 'tax_query' parameter, affecting all versions up to and including 1.1. This vulnerability arises from inadequate escaping of user-supplied inputs and insufficient preparation of existing SQL queries. As a result, unauthenticated attackers can manipulate queries, injecting additional SQL commands that may allow them to retrieve sensitive information from the database.

References